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What is claimed is: 

\ 

1. A method for securing an accessible computer system, the method comprising: 

2 monitoring a computer system for connection transactions between at least one access 

3 requestor and at least one access^provider; and 

4 denying access by the access requestor to the access provider when a number of 

5 connection transactions initiated by the access requestor exceeds a configurable threshold 

6 number during a first configurable period of time. 

1 2. The method as in claim 1, wherein the monitoring includes detecting connection 

■ — — t- 

1 3. The method as in claim 2, wherein the monitoring further includes counting the 

2 number of connection transactions initiated by the access requestor during the first 

3 configurable period of time. 

1 4. The method as in claim 3, wherem the monitoring further includes comparing the 

2 number of connection transactions initiated by the access requestor during the first 

3 configurable period of time to the configurable threshold number. 



1 5. The method as in claim 1, wherein the monitoring includes detecting connection 

1 Y 1 — 

1 6. The method as in claim 5, wherein the monitoring further includes counting the 

2 number of connection transactions initiated by the Internet protocol address during the first 

3 configurable period of time. 

1 7. The method as in claim 6, wherein the monitoring further includes comparing the 

2 number of connection transactions initiated by theVnternet protocol address during the first 

3 configurable period of time to the configurable threshold number. 



1 8. The method as in claim 6, wherein the monitoring includes monitoring a computer 

2 system for connection transactions made using TCP. 
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9. The method as in claim 5, wherein the detecting includes identifying the Internet 
protocol address through the use of a header attached to a message representing the 
connection transaction being detected 



10. The method as in claim 1, wherein the denying of access includes denying access to 
the access provider by the access requestor for a second configurable period of time. 

1 1 . The method as in claim 10, wherein the denying of access further includes resetting 
the second configurable period of time after detecting a new connection transaction initiated 
by the access requestor during the second configurable period of time. 



12. The method as in claim 1, wherein the denying of access includes denying access to 
the access provider by the access requestor for a second configurable period of time after 
detecting a most recent connection transaction initiated by the access requestor. 



13. The method as in claim 1, wherein the access requestor is a client and the access 
provider is a host such that the monitoring includes detecting connection transactions 
between at least one client and at least one host. 



14. The method as in claim 1, wherein the access requestor is a client and the access 
provider is a host such that the monitoring includes detecting connection transactions 
between the access requestor and a plurality of access providers. 



15. A system for securing an accessible computer system, comprising: 

means for monitoring a computer system for connection transactions between at least 



one access requestor and at least one access provider; and 



means for denying access by the access requestor to the access provider when a 
number of connection transactions initiated by the access requestor exceed a configurable 
threshold number during a first configurable period ontime. 

1 6. The system of claim 1 5, wherein the means for monitoring includes: 

means for detecting connection transactions initialed by the access requestor; 
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3 means for counting the number of connection transactions initiated by the access 

4 requestor during the first configurable period of time; and 

5 means for comparing the number of connection transactions initiated by the access 

6 requestor during the first configurable period of time to the configurable threshold number. 

1 1 7. The system of claim 1 5, wherein the means for monitoring includes: 

2 means for detecting connection transactions between at least one Internet protocol 

3 address and the access provider; 

4 means for counting the number of connection transactions initiated by the Internet 
protocol address during the first configurable period of time; and 

6 means for comparing the number of connection transactions initiated by the Internet 

7 protocol address during the first configurable period of time to the configurable threshold 

8 number. 1 

1 1 8 . The system of claim 1 7, wherein the means for monitoring includes means for 

2 monitoring a computer system for connection transactions made using TCP. 

1 19. The system of claim 17, wherein the means for detecting includes: 

2 means for identifying the Internet protocol address through the use of a header 

3 attached to a message representing the connection transaction being detected. 

1 20. The system of claim 15, wherein the me,ans for denying access includes: 

2 means for denying access to the access provider by the access requestor for a second 

3 configurable period of time. \ 

1 21. The system of claim 20, wherein the means\for denying access further includes: 

2 means for resetting the second configurable period of time after detecting a new 

3 connection transaction initiated by the access requestor during the second configurable 

4 period of time. \ 

1 22. The system of claim 1 5, wherein the means fondenying access includes: 
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means for denying access to the access provider by the access requestor for a second 
configurable period of time a^er detecting a most recent connection transaction initiated by 
the access requestor. 

23. The system of claim 15, wherein the access requestor is a client and the access 
provider is a host such that the means for monitoring includes: 

means for detecting connection transactions between at least one client and at least 
one host. 

\ 

\ 

24. The system of claim 15, wherein -the access requestor is a client and the access 
provider is a host such that the means foAnonitoring includes: 

3 means for detecting connection transactions between the access requestor and a 

4 plurality of access providers. 

1 25. A system for securing an accessible computer system, comprising: 

2 a monitoring component that is stractu^ed and arranged to monitor a computer system 

3 for connection transactions between at least on^ access requestor and at least one access 

4 provider; and 

5 a blocking component that is structured and arranged to deny access by the access 

6 requestor to the access provider when a number onconnection transactions initiated by the 

7 access requestor exceed a configurable threshold number during a first configurable period of 

8 time. 

1 26. The system of claim 25, wherein the monitoring component comprises: 

2 a detection component that is structured and arranged to detect connection 

3 transactions initiated by the access requestor; 

4 a counting component that is structured and arranged to count the number of 

5 connection transactions initiated by the access requestor during the first configurable period 

6 of time; and \ 

7 a comparing component that is structured and arranged to compare the number of 

8 connection transactions initiated by the access requestor during the first configurable period 

9 of time to the configurable threshold number. 
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27. The system of claim 25, wherein the monitoring component comprises: 

a detection component that is structured and arranged to detect connection 
transactions between at least one Internet protocol address and the access provider; 

a counting component that is structured and arranged to count the number of 
connection transactions initialed by the Internet protocol address during the first configurable 
period of time; and 

a comparing componenthhat is structured and arranged to compare the number of 
connection transactions initiated\by the Internet protocol address during the first configurable 

1 28 . The system of claim 27, wherein the connection transactions include connections 

2 made using TCP. 

1 29. The system of claim 27, wherein the detection component comprises: 

2 an identifying component that fs structured and arranged to identify the Internet 

3 protocol address through the use of a header attached to a message representing the 

4 connection transaction being detected. 

1 30. The system of claim 25, wherein the blocking component comprises: 

2 an access preventer that is structured and arranged to deny access to the access 

3 provider by the access requestor for a second configurable period of time. 

1 31. The system of claim 30, wherein the blocking component further comprises: 

2 a timing component that is structured and arranged to measure the second 

3 configurable period of time during which the acces^ preventer denies access to the access 

4 provider by the access requestor. 

1 32. The system of claim 3 1 , wherein the blocking component further comprises: 

2 a reset component that is structured and arranged to reset the timing component after 

3 detecting a new connection transaction initiated by the access requestor during the second 

4 configurable period of time. 
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1 33. The system of claim 25 , wherein the blocking component comprises : 

2 an access preventer that is structured and arranged to deny access to the access 

3 provider by the access requestor for a second configurable period of time after detecting a 

4 most recent connection transaction initiated by the access requestor. 

1 34. The system of claim 25, wherein the access requestor is a client and the access 

2 provider is a host such that the monitoring component comprises: 

3 a detection component that is structured and arranged to detect connection 

4 transactions between at least one client and at least one host. 

1 35. The system of claim 25, wherein the access requestor is a client and the access 

2 provider is a host such that the monitoring component comprises: 

3 a detection component that is structured and arranged to detect connection 

4 transactions between the access requestor and a plurality of access providers. 

1 36. The system of claim 25, wherein the monitoring component and the blocking 

2 component are included in a host computer system that receives communications from a 

\ 

1 37. The system of claim 25, wherein the monitoring component and the blocking 

2 component are included in a switch that receives communications from a host computer 

3 system. 

\ 
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